Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ themes/blowfish/ # Theme submodule

## ℹ️ About

I wrote a post about migrating from Ghost to Hugo read it [here](https://blog.axell.dev/favorite/why-i-migrated-from-ghost-to-hugo-and-cloudflare/).
I wrote a post about migrating from Ghost to Hugo - read it [here](https://blog.axell.dev/favorite/why-i-migrated-from-ghost-to-hugo-and-cloudflare/).

## External Dependencies

Expand Down
14 changes: 7 additions & 7 deletions content/about/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,22 +24,22 @@ heroStyle: "background"

## Background

Started as an intern managing GitLab and CI/CD pipelines at [Kiwi.com](https://kiwi.com). After finishing a master's degree I came back as a Python engineer, but eventually found my way back to infrastructure which is where I belong.
Started as an intern managing GitLab and CI/CD pipelines at [Kiwi.com](https://kiwi.com). After finishing a master's degree I came back as a Python engineer, but eventually found my way back to infrastructure - which is where I belong.

## Currently

DevOps/SRE engineer at [Capital Markets Gateway](https://cmgfi.com), where I work on:

- **Kubernetes** managing AKS clusters at scale
- **Infrastructure as Code** Terraform for cloud provisioning
- **CI/CD** GitHub Actions pipelines for engineering teams
- **Kubernetes** - managing AKS clusters at scale
- **Infrastructure as Code** - Terraform for cloud provisioning
- **CI/CD** - GitHub Actions pipelines for engineering teams

## Side Projects

In my free time I maintain **[HomeOps](https://github.com/axeII/home-ops)** a fully GitOps-managed home lab running on Kubernetes. It's where I experiment with things before they're mainstream (and occasionally break my home network 😱).
In my free time I maintain **[HomeOps](https://github.com/axeII/home-ops)** - a fully GitOps-managed home lab running on Kubernetes. It's where I experiment with things before they're mainstream (and occasionally break my home network 😱).

## This Blog

I write about DevOps, infrastructure, macOS, home labs, and security. Posts tend to be practical things I actually ran into and had to figure out. The blog itself is [open source](https://github.com/axeII/axell.dev).
I write about DevOps, infrastructure, macOS, home labs, and security. Posts tend to be practical - things I actually ran into and had to figure out. The blog itself is [open source](https://github.com/axeII/axell.dev).

Btw if you are on Firefox you will see the background image made by **Damir Babacic** from [here](https://unsplash.com/@onemorephoto). I highly recommend to check out his work, it's amazing. Why the photo is only visible on Firefox? It's because of Firefox's SMIL engine simply can't handle smooth bubbles animations 😢 (it's a known long-standing performance gap).
Btw the background image is made by **Damir Babacic** from [here](https://unsplash.com/@onemorephoto). I highly recommend to check out his work, it's amazing. Some users might see bubles animated SVG instead - I like that one more but it has performance issues on some platforms (especially Firefox and iOS).
2 changes: 1 addition & 1 deletion content/posts/my-home-lab/index.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
categories: ["tech", "sys admin"]
date: 2021-07-02T23:46:00Z
description: "Introduction to building a home lab in a small space hardware choices, rack constraints, noise, and heat challenges."
description: "Introduction to building a home lab in a small space - hardware choices, rack constraints, noise, and heat challenges."
draft: false
slug: "my-home-lab"
tags: ["tech", "sys admin","home ops"]
Expand Down
20 changes: 10 additions & 10 deletions content/posts/plex-incident-debugging-infrastructure/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,15 @@ categories: ["tech", "cyber security"]
title: "Debugging Suspicious Plex Connections: A Deep Dive Into My Self-Hosted Infrastructure"
---

Last week, Plex announced a security [incident](https://forums.plex.tv/t/important-notice-of-security-incident/930523) where their user database was compromised, forcing everyone to log out including server connections. As someone who self-hosts a Plex instance that’s publicly reachable (no VPN in front), this grabbed my attention. Beyond the Reddit threads and confusion, it was a good opportunity to audit my infrastructure. In this post, I’ll walk through how I autdit my Plex server and chased down some weird connections to my Plex server using Grafana, Tautulli, and Cloudflare Tunnel.
Last week, Plex announced a security [incident](https://forums.plex.tv/t/important-notice-of-security-incident/930523) where their user database was compromised, forcing everyone to log out - including server connections. As someone who self-hosts a Plex instance that’s publicly reachable (no VPN in front), this grabbed my attention. Beyond the Reddit threads and confusion, it was a good opportunity to audit my infrastructure. In this post, I’ll walk through how I autdit my Plex server and chased down some weird connections to my Plex server using Grafana, Tautulli, and Cloudflare Tunnel.

## The Wake-Up Call

The Plex incident was a reminder that even well‑secured services can get hit. After the email landed, I did a quick audit: review recent activity, confirm configs, and look for anything odd on the network. When you self‑host, you own both the security and the monitoring. Here’s how I approached it:

## The Investigation Begins

My first instinct was to check my monitoring stack to see if there had been any unusual activity on my Plex server. This is exactly why having proper observability in a homelab matters during incidents, you need answers quickly. Without logs and monitoring, you’re flying blind. Before we continue here is a quick overview of my setup:
My first instinct was to check my monitoring stack to see if there had been any unusual activity on my Plex server. This is exactly why having proper observability in a homelab matters - during incidents, you need answers quickly. Without logs and monitoring, you’re flying blind. Before we continue here is a quick overview of my setup:

### Core Components

Expand All @@ -34,17 +34,17 @@ My first instinct was to check my monitoring stack to see if there had been any

### Step 1: Grafana logs

I started with my Grafana dashboard, which aggregates logs from all services running on Kubernetes including Plex. Almost immediately, something looked off: connections were happening regularly between ~3–9 AM. That’s a unlike play time for my friends or family to use my Plex instance.
I started with my Grafana dashboard, which aggregates logs from all services running on Kubernetes - including Plex. Almost immediately, something looked off: connections were happening regularly between ~3–9 AM. That’s a unlike play time for my friends or family to use my Plex instance.

> Worth noting: there’s a known Cloudflare Tunnel issue where some connections aren’t closed properly (see: <https://github.com/cloudflare/cloudflared/issues/1300>), but the pattern here was too consistent to ignore.

The timing was the first red flag. The connections also had a repeatable signature it almost looked like someone was probing the instance.
The timing was the first red flag. The connections also had a repeatable signature - it almost looked like someone was probing the instance.

![grafana logs](https://img.axell.dev/plex%3Agrafana.webp "Grafana logs showing suspicious connections")

### Step 2: Tautulli check

To verify my suspicions, I checked Tautulli a great tool for Plex user activity, play stats, and connection details. Tautulli confirmed it: during those ~3–9 AM windows, there were no active users on my server.
To verify my suspicions, I checked Tautulli - a great tool for Plex user activity, play stats, and connection details. Tautulli confirmed it: during those ~3–9 AM windows, there were no active users on my server.

That ruled out legitimate activity. The question became: what (or who) was making these connections?

Expand All @@ -64,11 +64,11 @@ This is where it got interesting. Digging deeper into the Cloudflare admin panel

After a longer-than-I’d-like investigation, I finally found the source: my friend’s Plex server.

Years ago, we connected our Plex servers for fun probably to share libraries or test something and then completely forgot about it. The connection kept humming along in the background.
Years ago, we connected our Plex servers for fun - probably to share libraries or test something - and then completely forgot about it. The connection kept humming along in the background.

![cloudflare2](https://img.axell.dev/plex%3Acloudlfare2.webp "The Suspicious IP address which was my friend's home ip in the end")

My friend’s server was periodically reaching out to mine, likely for status checks or library updates. Not malicious just unexpected and it explained the ~3–9 AM pattern (likely maintenance windows on his side).
My friend’s server was periodically reaching out to mine, likely for status checks or library updates. Not malicious - just unexpected - and it explained the ~3–9 AM pattern (likely maintenance windows on his side).

## Lessons Learned

Expand All @@ -78,9 +78,9 @@ This incident taught me a few useful lessons about infrastructure and security:
- Documentation Matters
- Monitoring Pays Off

Good monitoring (Grafana stack + Tautulli) made this fast and boring which is exactly what you want. Without it, I might never have noticed the pattern.
Good monitoring (Grafana stack + Tautulli) made this fast and boring - which is exactly what you want. Without it, I might never have noticed the pattern.

Even simple, harmless configs can age into problems. What started as a fun experiment turned into a forgotten connection that looked suspicious during a review. If we’d documented the server‑to‑server connection, this would have been a 2‑minute check. Write down changes even the “temporary” ones.
Even simple, harmless configs can age into problems. What started as a fun experiment turned into a forgotten connection that looked suspicious during a review. If we’d documented the server‑to‑server connection, this would have been a 2‑minute check. Write down changes - even the “temporary” ones.

---

Expand All @@ -98,7 +98,7 @@ If you run Plex (or anything similar) at home, here’s what’s worked well for

## Conclusion

The Plex incident was a good reminder to audit my setup. The “suspicious” connections turned out to be harmless a long‑forgotten server share but the investigation proved the value of visibility.
The Plex incident was a good reminder to audit my setup. The “suspicious” connections turned out to be harmless - a long‑forgotten server share - but the investigation proved the value of visibility.

Being able to trace connections end‑to‑end (Grafana logs → Cloudflare analytics) made it easy to gain confidence in the setup. If you self‑host, invest a little in observability and you’ll sleep better.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Why I Migrated my blog from Ghost to Hugo platform (and Cloudflare)
date: 2023-12-23
draft: false
slug: why-i-migrated-from-ghost-to-hugo-and-cloudflare
description: "Why I migrated from Ghost to Hugo and Cloudflare Pages cost, performance, maintenance, and GitOps deployment."
description: "Why I migrated from Ghost to Hugo and Cloudflare Pages - cost, performance, maintenance, and GitOps deployment."
tags: [Ghost, Hugo, Cloudflare]
categories: ["tech", "devops"]

Expand Down
Loading